Redact a document before pasting it into ChatGPT or Claude

#Why the black rectangle does not work

Let us start with the most expensive mistake, because people with good lawyers still make it.

In a PDF, drawing a black rectangle over text does not erase the text. A PDF stores glyphs and graphics separately. The rectangle is a graphic painted on top; the text is still underneath and can be selected, copied, searched and extracted with any tool. There is a long list of public leaks — governments, law firms, insurers — that consist of exactly that.

The same goes for many features called «redaction» in general-purpose editors: they cover visually and never touch the content.

What does work is replacing the text: removing the string from the content and putting another one in its place.

#The round trip

The part almost nobody implements is the way back, and it is what makes this usable in real work.

Out. The document says:

Patient Juan Carlos Pérez Gómez, ID 1.020.345.678, phone 310 555 0199,
presenting with chest pain for three days.

What you paste into the model says:

Patient [NOMBRE_1], ID [DOCUMENTO_1], phone [TELEFONO_1],
presenting with chest pain for three days.

The model keeps everything it needs to work: there is a patient, there is an identity document, the complaint is chest pain for three days. It does not keep who the patient is.

Back. The model answers with [NOMBRE_1] inside its text. On your machine, with the mapping generated during redaction, [NOMBRE_1] becomes Juan Carlos Pérez Gómez again. The mapping never left your machine.

This differs from what corpus-cleaning pipelines such as Dolma or datatrove do, replacing with a fixed irreversible token. For training, irreversibility is desirable. For asking questions it is a nuisance: it leaves you an answer full of holes to fill by hand.

#Why the placeholder must be consistent

If every occurrence of the same name gets a different placeholder, the text loses the thread:

[NOMBRE_1] signed the contract. [NOMBRE_7] undertakes to pay.
[NOMBRE_3] did not answer the notice.

The model cannot know they are the same person, and any reasoning about who owes what to whom breaks. With consistent placeholders the document's logical structure survives intact:

[NOMBRE_1] signed the contract. [NOMBRE_1] undertakes to pay.
[NOMBRE_1] did not answer the notice.

The same applies across types: if one number appears as an ID on one page and as a reference on another, it should get the same placeholder.

#What is detected well, and what is not

Here we should be honest, because the marketing in this category is optimistic.

Detected well, because the format is fixed and checkable:

• Email addresses
• Phone numbers with a recognisable prefix
• Identity documents with a check digit
• Dates
• IBAN, card numbers, license plates

Detected worse, because it depends on context:

• Names with no preceding label («Juan» on its own, mid-sentence)
• Names written unusually or mangled by OCR
• Informal addresses («next to the bakery»)
• Internal identifiers («file 4471-B»)

The number worth remembering: StarCoder's human annotators (arXiv:2305.06161) reached 99% recall on emails, 89% on names and 53% on generic identifiers, low enough that they excluded the category from training. If people annotating by hand get 53%, no automatic tool is going to give you 100%.

Practical consequence: review the result. A good tool highlights every finding so you can read them in thirty seconds before copying.

#A technical detail that caused a real bug

If you write the rules yourself, watch the whitespace.

A regular expression using \s* between the parts of a name crosses line breaks. In a document with the name at the end of a line, that captures the first word of the next line and, worse, leaves part of the name out. In a real case it leaked a patient's surname.

For separators inside a name, use only space and tab: [ \t].

#When this is not enough

Redaction reduces the personal data that leaves, which is exactly GDPR's data minimization principle (article 5.1.c). It does not make you automatically compliant:

• Redacted text can still be re-identifiable from context: if the document says «the only neurosurgeon in the hospital of a town of 4,000 people», the name is redundant.
• If the document is sensitive because of its content rather than its names — a commercial strategy, an unpublished design — redaction protects nothing.
• You are still the data controller. The tool lowers the risk; it does not assume it.

For those cases the option is a local model (Ollama, LM Studio) or an MCP server that processes on your machine, where the text does not leave at all.

#How to do it now

In the browser, nothing to install: drop the PDF into PDF to Markdown with redaction. It shows you the text with every finding highlighted, lets you copy it, and when you come back with the AI's answer it restores the real data in the same tab.

In the terminal, if this is part of a flow:

npx sirdas anonymize contract.pdf -o anonymous.md --map map.json
# … ask the model with anonymous.md …
npx sirdas restore answer.md --map map.json

The mapping is your file, on your disk. Lose it and the redaction stops being reversible; share it and it stops being redaction.